TechKnowSurge

VideoSecurityFree

DEMO: Dictionary Attack

A dictionary attack uses a predefined list of words to crack password hashes by systematically testing each entry until a match is found. This demonstration covers the full process using Hashcat on Kali Linux to crack an MD5 hash with a custom wordlist.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A dictionary attack is one of the most straightforward password-cracking techniques in use, relying on a prepared list of words tested against a stored password hash rather than generating random character combinations. Because most systems store passwords as hash values rather than plaintext, attackers must crack the hash to recover the original password, and dictionary attacks exploit the tendency of users to choose recognizable words as their credentials. This demonstration uses Kali Linux and the Hashcat password-cracking tool to illustrate the full attack workflow. The process begins by generating an MD5 hash of a known password, simulating how a password might be stored in a system database. Hashcat is then run with its MD5 mode against that hash, paired with a custom wordlist containing a small set of dictionary words. Within moments, Hashcat identifies the matching word and returns both the cracked password and its corresponding hash. The exercise highlights how effective dictionary attacks can be even with a limited wordlist, and underscores why passwords based on common words offer minimal protection against automated cracking tools. In a real-world scenario, attackers would typically use far more extensive wordlists, significantly increasing the likelihood of a successful crack against weak or reused credentials.

What you'll learn

Explain how a dictionary attack uses a wordlist to crack hashed passwords
Demonstrate the use of Hashcat to perform a dictionary attack against an MD5 password hash

What's covered

Dictionary Attack

What It Is
- Uses list of dictionary words
- Goal: crack a password
- Ethical hacking only
How Passwords Are Stored
- Stored as hash values
- Must crack hash to find password
Demo Setup
- Kali Linux machine
- Tool: Hashcat
- Generate MD5 hash
  - Echo password command
  - Password: nestful
Running the Attack
- Create dictionary file
  - Simple list of words
  - Larger lists for real attacks
- Hashcat command
  - dash m zero flag
  - Specify hash and dictionary
- Password successfully cracked

Key terms

Dictionary Attack: A type of brute force attack that uses a predefined list of common words and phrases to guess passwords.
Hash Function: A mathematical algorithm that converts input data of any size into a fixed-size output value used to verify data integrity.
Hashcat: An open-source password recovery and cracking tool that recovers plaintext passwords by comparing computed hash values against wordlists, brute-force sequences, or generated candidate patterns. It is widely used in authorized penetration testing and forensics.
Message Digest 5: Message Digest 5 is a widely used cryptographic hash function producing a 128-bit digest; MD5 is considered cryptographically broken due to collision vulnerabilities and must not be used for security-critical purposes such as digital signatures or certificate validation.
Wordlist: A file containing a list of candidate passwords used in a dictionary-based attack, where each entry is hashed and compared against the target hash.

Topics

Dictionary Attack Password Cracking Hashcat Md5 Cryptography Kali Linux Ethical Hacking

Transcript

A dictionary attack is pretty simplistic. It just means that we're using a list of dictionary words to try to crack a password. Just a reminder that this is for ethical hacking purposes only.

Generating a hash

I'm on my demo machine here, a Kali Linux box, and what we're going to do is use hashcat to crack a password. But first of all, we have to create a hash of the password. Passwords are stored as a hash value, so what we need to do is figure out how to crack this hash value to figure out what the password is.

So let's generate a hash first. What I'm going to do is echo the password we're going to use, which is nestful, and then we're going to do an MD5 hash on that. So there's our hash right there.

The dictionary file

Now what I'm going to do is show you the dictionary that we're going to use, so: nano dictionary. You'll notice here that it's not a complete list of everything in the dictionary. I just created some simple dictionary words in here. That's what we're going to use as an example, but I'd probably have a longer list if I was actually cracking a database or a password here.

Running the attack

So next, what we're going to do is run our hashcat. I'm going to do a -m and we're going to choose 0. And then we will specify the hash, which is just this hash that's been copied down there. And then I'm going to use that text document with those dictionary words in it. So then I'm going to hit enter. It starts doing it, and there it is. It's been cracked. So here is the password that it figured out, and here's the hash of that password.

Pretty simplistic. That's a dictionary attack. It's not very complicated at all. It's just using dictionary words to try to crack a password or some sort of password database.

Here's the attack card on a dictionary attack, where we're just using a list of dictionary words to guess a password. And so here we have some dictionary words that we ran against a hash to crack it and figure out what the actual password is.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →